diff --git a/pkg/systemd/sysconfig.template b/pkg/systemd/sysconfig.template
index 113cd6de..d54bd920 100644
--- a/pkg/systemd/sysconfig.template
+++ b/pkg/systemd/sysconfig.template
@@ -20,6 +20,12 @@
 #
 # Vlan ID used for untagged traffic on unbridged ports (1-4095):
 # FLAGS_port_untagged_vid=1
+#
+# Set a Packets per Seconds rate limit for traffic to controller.
+#  -1 = auto (unlimited for KNET, 1024 for TAP)
+#   0 = force unlimited
+# Default is auto.
+# FLAGS_rx_rate_limit=-1
 
 ### glog logging configuration
 #
diff --git a/src/baseboxd.cc b/src/baseboxd.cc
index 584dd4d1..104726e3 100644
--- a/src/baseboxd.cc
+++ b/src/baseboxd.cc
@@ -25,6 +25,8 @@ DEFINE_bool(clear_switch_configuration, true,
             "Clear switch configuration on connect");
 DEFINE_int32(port_untagged_vid, 1,
              "VLAN ID used for untagged traffic on unbridged ports");
+DEFINE_int32(rx_rate_limit, -1,
+             "PPS limit for traffic to controller (-1 = auto, 0 = force unlimited)"
 
 static bool validate_port(const char *flagname, gflags::int32 value) {
   VLOG(3) << __FUNCTION__ << ": flagname=" << flagname << ", value=" << value;
diff --git a/src/of-dpa/controller.cc b/src/of-dpa/controller.cc
index ba7592e2..dac3aa80 100644
--- a/src/of-dpa/controller.cc
+++ b/src/of-dpa/controller.cc
@@ -22,6 +22,8 @@
 #include "utils/rofl-utils.h"
 
 DECLARE_bool(clear_switch_configuration);
+DECLARE_bool(use_knet);
+DECLARE_int32(rx_rate_limit);
 
 namespace basebox {
 
@@ -100,6 +102,20 @@ void controller::handle_dpt_open(rofl::crofdpt &dpt) {
     ofdpa->ofdpaStgReset();
   }
 
+  int rate = FLAGS_rx_rate_limit;
+  if (rate < 0) {
+    if (FLAGS_use_knet)
+      // Packets use a different channel, so set unlimited.
+      rate = 0;
+    else
+      // TAP packets use the same channel as control traffic, so set the
+      // default limit of 1024 pps (about ~11 Mbit/s) to ensure the OpenFlow
+      // connection is stable.
+      rate = 1024;
+  }
+
+  ofdpa->ofdpaRxRateSet(rate);
+
   dpt.send_features_request(rofl::cauxid(0), 1);
   dpt.send_desc_stats_request(rofl::cauxid(0), 0, 1);
 
diff --git a/src/of-dpa/ofdpa_client.cc b/src/of-dpa/ofdpa_client.cc
index 30f62393..69c94b17 100644
--- a/src/of-dpa/ofdpa_client.cc
+++ b/src/of-dpa/ofdpa_client.cc
@@ -513,4 +513,21 @@ ofdpa_client::ofdpaTrunkPortPSCSet(uint32_t lag_id, uint8_t mode) {
   return response.status();
 }
 
+ofdpa::OfdpaStatus::OfdpaStatusCode ofdpa_client::ofdpaRxRateSet(int32_t pps) {
+  ::OfdpaStatus response;
+  ::ClientContext context;
+  ::Pps request;
+
+  context.set_wait_for_ready(true);
+
+  request.set_pps(pps);
+
+  ::Status rv = stub_->ofdpaRxRateSet(&context, request, &response);
+  if (not rv.ok()) {
+    return ofdpa::OfdpaStatus::OFDPA_E_RPC;
+  }
+
+  return response.status();
+}
+
 } // namespace basebox
diff --git a/src/of-dpa/ofdpa_client.h b/src/of-dpa/ofdpa_client.h
index a456345e..ecce4cba 100644
--- a/src/of-dpa/ofdpa_client.h
+++ b/src/of-dpa/ofdpa_client.h
@@ -80,6 +80,7 @@ class ofdpa_client {
 
   ofdpa::OfdpaStatus::OfdpaStatusCode ofdpaTrunkPortPSCSet(uint32_t lag_id,
                                                            uint8_t mode);
+  ofdpa::OfdpaStatus::OfdpaStatusCode ofdpaRxRateSet(int32_t pps);
 
 private:
   ofdpa::OfdpaStatus::OfdpaStatusCode